karajan-code 4.20.1 → 4.21.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "4.20.1",
+  "version": "4.21.0",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",

package/src/cli/advanced-commands.js

@@ -31,7 +31,7 @@ export const ADVANCED_GROUPS = [
   { title: "Análisis pre-run", commands: ["discover", "triage", "researcher", "architect", "onboard", "brief"] },
   { title: "Búsqueda / RAG", commands: ["rag", "qmd", "watch"] },
   { title: "Calidad / auditoría", commands: ["audit", "check", "mutate", "webperf", "sonar", "privacy", "release", "policy"] },
-  { title: "Sesión / board", commands: ["resume", "report", "board", "hu", "adr", "worktree", "undo", "standby", "sentinel"] },
+  { title: "Sesión / board", commands: ["resume", "report", "board", "hu", "adr", "worktree", "undo", "standby", "sentinel", "identity"] },
   { title: "Infra / setup", commands: ["install-tools", "ollama", "skills", "roles", "agents", "env"] },
   { title: "Mantenimiento", commands: ["clean", "sync", "telemetry", "report-issue"] },
 ];

package/src/cli/register-meta.js

@@ -4,6 +4,7 @@ import { researcherCommand } from "../commands/researcher.js";
 import { architectCommand } from "../commands/architect.js";
 import { onboardCommand } from "../commands/onboard.js";
 import { startCommand } from "../commands/start.js";
+import { identityCommand } from "../commands/identity.js";
 import { ragIndexCommand, ragQueryCommand, ragInstallHooksCommand, ragEvalCommand } from "../commands/rag.js";
 import { qmdQueryCommand } from "../commands/qmd.js";
 import { ragMcpCommand } from "../commands/rag-mcp.js";
@@ -120,6 +121,30 @@ export function registerMeta(program, { pkgVersion }) {
       });
     });
 
+  // IDN-A (KJC-TSK-0762, epic KJC-PCS-0079): identity lock per clone.
+  const identityCmd = program
+    .command("identity")
+    .description("Identity lock: which gh account and git email this clone is worked with (.karajan/identity.local.yml, never tracked)");
+  identityCmd
+    .command("show", { isDefault: true })
+    .description("Declared identity vs the active one (exit 2 on mismatch or when undeclared)")
+    .action(async (flags) => {
+      await withConfig(pkgVersion, "identity-show", flags, async ({ config }) => {
+        process.exitCode = await identityCommand({ action: "show", config, flags });
+      });
+    });
+  identityCmd
+    .command("set")
+    .description("Declare this clone's identity from the active gh session and git config (or --gh/--email)")
+    .option("--gh <user>", "gh account to bind")
+    .option("--email <email>", "git email to bind")
+    .option("--yes", "Do not ask for confirmation")
+    .action(async (flags) => {
+      await withConfig(pkgVersion, "identity-set", flags, async ({ config }) => {
+        process.exitCode = await identityCommand({ action: "set", config, flags });
+      });
+    });
+
   program
     .command("start")
     .description("Single entry point: assess the project and recommend the next step")

package/src/commands/harden.js

@@ -23,6 +23,7 @@ import { installSentinelHooks } from "../harden/sentinel-hooks.js";
 import { detectStackRoots } from "../harden/stack-roots.js";
 import { installWorkflows } from "../harden/workflow-engine.js";
 import { detectTestFramework } from "../utils/project-detect.js";
+import { ensureIdentity } from "../identity/bootstrap.js";
 
 const JS_TEST_CMD = {
   vitest: "npx vitest run",
@@ -191,5 +192,12 @@ export async function hardenCommand({
   for (const w of out.workflows) logger.info?.(`  • ${w.file}: ${w.action}`);
   for (const g of out.guidelines) logger.info?.(`  • ${g.file}: ${g.action}`);
   if (!dryRun) logger.info?.("core.hooksPath set. Verify later with `kj check`.");
+  // IDN-A (KJC-TSK-0762): a hardened clone declares who works it. Captured
+  // only with a human confirming; headless runs get the pending command.
+  if (!dryRun) {
+    const id = await ensureIdentity({ projectDir, logger });
+    out.identity = id.declared ? id.identity : null;
+    if (id.pending) out.identityPending = id.pending;
+  }
   return out;
 }

package/src/commands/identity.js

@@ -0,0 +1,60 @@
+/**
+ * `kj identity show|set` (IDN-A, KJC-TSK-0762, epic KJC-PCS-0079).
+ *
+ *   show  — declared identity vs what is ACTIVE now; exit 2 on mismatch or
+ *           when nothing is declared (scriptable: the gate and hooks reuse it).
+ *   set   — capture the effective gh account + git email (or --gh/--email),
+ *           confirm on a TTY, write .karajan/identity.local.yml. Never invents:
+ *           no session and no flags → exit 1.
+ */
+
+import { readIdentity, writeIdentity } from "../identity/store.js";
+import { activeGhUser, effectiveGitEmail } from "../identity/detect.js";
+import { compareIdentity } from "../identity/compare.js";
+import { createWizard, isTTY } from "../utils/wizard.js";
+
+export async function identityCommand({ action = "show", config, flags = {}, deps = {} }) {
+  const projectDir = config?.projectDir || process.cwd();
+  const log = deps.log || console.log;
+  const tty = deps.isTTY || isTTY;
+  const detectOpts = { hostsPath: deps.hostsPath, gitFn: deps.gitFn };
+  const effective = {
+    gh_user: activeGhUser(detectOpts.hostsPath ? { hostsPath: detectOpts.hostsPath } : {}),
+    git_email: effectiveGitEmail(projectDir, detectOpts.gitFn ? { gitFn: detectOpts.gitFn } : {}),
+  };
+
+  if (action === "set") {
+    const candidate = { gh_user: flags.gh || effective.gh_user, git_email: flags.email || effective.git_email };
+    if (!candidate.gh_user || !candidate.git_email) {
+      log(`kj identity: cannot declare — gh account: ${candidate.gh_user ?? "no session"}, git email: ${candidate.git_email ?? "none"}. Log in / set git config, or pass --gh <user> --email <email>.`);
+      return 1;
+    }
+    if (tty() && !flags.yes) {
+      const wizard = (deps.makeWizard || createWizard)();
+      try {
+        const ok = await wizard.confirm(`Bind this clone to gh ${candidate.gh_user} / git ${candidate.git_email}?`, true);
+        if (!ok) { log("kj identity: not declared."); return 1; }
+      } finally { wizard.close(); }
+    } else if (!flags.gh || !flags.email) {
+      // Proven live on day one: the active gh session had been flipped by
+      // ANOTHER session, and --yes bound the clone to the wrong account.
+      // Binding without confirmation is allowed, but never silent.
+      log("kj identity: WARNING — binding the ACTIVE session as-is without confirmation (another session may have switched it); prefer --gh/--email explicitly and verify with `kj identity show`.");
+    }
+    writeIdentity(projectDir, candidate);
+    log(`kj identity: declared gh ${candidate.gh_user} / git ${candidate.git_email} → .karajan/identity.local.yml (ignored by git).`);
+    return 0;
+  }
+
+  const declared = readIdentity(projectDir);
+  const result = compareIdentity(declared, effective);
+  if (!declared) {
+    log("kj identity: no identity declared for this clone — run `kj identity set`.");
+    return 2;
+  }
+  const mark = (field) => (result.mismatches.some((m) => m.field === field) ? "DISTINTA" : "ACTIVA");
+  log(`gh_user    ${declared.gh_user}  [${mark("gh_user")}: ${effective.gh_user ?? "no session"}]`);
+  log(`git_email  ${declared.git_email}  [${mark("git_email")}: ${effective.git_email ?? "none"}]`);
+  for (const m of result.mismatches) log(`  → ${m.remedy}`);
+  return result.ok ? 0 : 2;
+}

package/src/harden/hook-templates.js

@@ -52,11 +52,49 @@ function baseBranchGuard(baseBranch) {
   ];
 }
 
+// IDN-C (KJC-TSK-0764, ADR 0005): identity lock at tier B — the declared clone
+// identity (.karajan/identity.local.yml) governs authorship on commit and the
+// gh session on push, on ANY host. Undeclared = advisory only (old clones keep
+// working); the fail-closed default is the Sentinel's (IDN-B).
+function identityGuard(hook) {
+  const head = [
+    "# Identity lock (IDN-C, ADR 0005) — this clone's declared identity governs.",
+    'if [ "$KJ_ALLOW_IDENTITY" != "1" ] && [ -f .karajan/identity.local.yml ]; then',
+  ];
+  const tail = [
+    "elif [ ! -f .karajan/identity.local.yml ]; then",
+    "  echo 'kj harden: no identity declared for this clone — run kj identity set (advisory)'",
+    "fi",
+  ];
+  if (hook === "pre-commit") {
+    return [
+      ...head,
+      "  kj_declared_email=$(sed -n 's/^git_email:[[:space:]]*//p' .karajan/identity.local.yml | head -n1)",
+      "  kj_author=$(git var GIT_AUTHOR_IDENT | sed 's/.*<\\(.*\\)>.*/\\1/')",
+      "  kj_committer=$(git var GIT_COMMITTER_IDENT | sed 's/.*<\\(.*\\)>.*/\\1/')",
+      '  if [ -n "$kj_declared_email" ] && { [ "$kj_author" != "$kj_declared_email" ] || [ "$kj_committer" != "$kj_declared_email" ]; }; then',
+      '    echo "kj harden: identity lock — committing as $kj_author / $kj_committer but this clone is declared as $kj_declared_email (kj identity show; KJ_ALLOW_IDENTITY=1 to override)"; exit 1',
+      "  fi",
+      ...tail,
+    ];
+  }
+  return [
+    ...head,
+    "  kj_declared_gh=$(sed -n 's/^gh_user:[[:space:]]*//p' .karajan/identity.local.yml | head -n1)",
+    '  kj_hosts="${GH_CONFIG_DIR:-${XDG_CONFIG_HOME:-$HOME/.config}/gh}/hosts.yml"',
+    "  kj_active_gh=$(awk '/^github.com:/{f=1;next} f&&/^[^[:space:]]/{f=0} f&&/^[[:space:]]*user:/{sub(/^[[:space:]]*user:[[:space:]]*/,\"\");print;exit}' \"$kj_hosts\" 2>/dev/null)",
+    '  if [ -n "$kj_declared_gh" ] && [ "$kj_active_gh" != "$kj_declared_gh" ]; then',
+    '    echo "kj harden: identity lock — gh session is ${kj_active_gh:-none} but this clone is declared as $kj_declared_gh — run: gh auth switch --user $kj_declared_gh (KJ_ALLOW_IDENTITY=1 to override)"; exit 1',
+    "  fi",
+    ...tail,
+  ];
+}
+
 export function hookBody(hook, cmds = {}, { globalHooksDir = null, baseBranch = null } = {}) {
   const chain = chainToGlobal(hook, globalHooksDir);
   switch (hook) {
     case "pre-commit": {
-      const lines = [...baseBranchGuard(baseBranch), "# Lint + format the working tree with the project's native tools."];
+      const lines = [...baseBranchGuard(baseBranch), ...identityGuard("pre-commit"), "# Lint + format the working tree with the project's native tools."];
       if (cmds.lint) lines.push(`${cmds.lint} || { echo 'kj harden: lint failed'; exit 1; }`);
       if (cmds.format) lines.push(`${cmds.format} || { echo 'kj harden: format check failed'; exit 1; }`);
       if (!cmds.lint && !cmds.format) lines.push("# (no lint/format command detected for this stack)");
@@ -93,6 +131,7 @@ export function hookBody(hook, cmds = {}, { globalHooksDir = null, baseBranch =
         "  echo 'kj harden: git user.name/user.email not set — refusing to push'; exit 1",
         "fi",
         'echo "kj harden: pushing as $(git config user.name) <$(git config user.email)>"',
+        ...identityGuard("pre-push"),
         "# Run the test suite before pushing.",
       ];
       if (cmds.test) lines.push(`${cmds.test} || { echo 'kj harden: tests failed'; exit 1; }`);

package/src/harden/sentinel-hooks.js

@@ -66,8 +66,12 @@ export const foreignLane = (targetDir) => {
   const common = _git("rev-parse --path-format=absolute --git-common-dir", targetDir);
   return common && common === _home.common ? top : null;
 };
+// KJC-TSK-0765 board-sync: cards merged in this session but not yet moved in
+// the tracker. The method does not advance until the board is true.
+export const pendingMoves = (s) => (s && Array.isArray(s.pending_moves) ? s.pending_moves : []);
+export const pendingText = (p) => (p.card ? p.card : "card sin identificar") + " (PR #" + p.pr + ") mergeada sin mover en el tracker — muevela a To Validate / Fixed con sus commits (update_card del PG o kj hu move)";
 export const violations = (s, branch) => {
-  const v = [];
+  const v = pendingMoves(s).map(pendingText);
   if (!s || !(s.edited_sources || []).length) return v;
   if (BASE_BRANCHES.has(branch)) v.push("Fuentes editadas en la rama base '" + branch + "' — crea una rama: git checkout -b feat/<CARD-ID>-descripcion");
   else if (branch && !CARD.test(branch)) v.push("La rama '" + branch + "' no referencia ninguna card — usa feat/<CARD-ID>-descripcion (y una card VIVA en el board)");
@@ -89,13 +93,62 @@ const POST_BODY = `#!/usr/bin/env node
 // Records deterministic method facts per session; never blocks, never fails
 // a tool call (PostToolUse, always exit 0).
 import { relative } from "node:path";
-import { CODE, TESTS, ROOT, load, save, session } from "./sentinel-lib.mjs";
-const ESCAPES = ["KJ_ALLOW_WRITE", "KJ_ALLOW_REWRITE", "KJ_ALLOW_NO_CARD", "KJ_ALLOW_NO_TESTS", "KJ_ALLOW_PII", "KJ_ALLOW_POLICY"];
+import { spawnSync } from "node:child_process";
+import { CODE, TESTS, ROOT, CARD, branchOf, load, save, session } from "./sentinel-lib.mjs";
+const ESCAPES = ["KJ_ALLOW_WRITE", "KJ_ALLOW_REWRITE", "KJ_ALLOW_NO_CARD", "KJ_ALLOW_NO_TESTS", "KJ_ALLOW_PII", "KJ_ALLOW_POLICY", "KJ_ALLOW_IDENTITY", "KJ_ALLOW_BOARD"];
 let raw = "";
 process.stdin.on("data", (d) => { raw += d; });
 process.stdin.on("end", () => {
   try {
-    const { session_id: sid = "default", tool_name: tool, tool_input: input = {} } = JSON.parse(raw);
+    const { session_id: sid = "default", tool_name: tool, tool_input: input = {}, tool_response: response = {} } = JSON.parse(raw);
+    // KJC-TSK-0765 board-sync: a merge that gh CONFIRMS leaves its card pending
+    // in the tracker (the PreToolUse gate then refuses to advance until it is
+    // moved). Recorded here, after the fact, so a failed merge never blocks.
+    const text = typeof response === "string" ? response : JSON.stringify(response);
+    // Closing states that count as "registered in the tracker" (PG statuses and
+    // HU Board moves). The pending entry is cleared by the REAL tool call that
+    // moved the card — never by a promise in the agent's prose.
+    const CLOSING = ["to validate", "to-validate", "fixed", "verified", "closed", "done", "done&validated", "validated"];
+    const clearPending = (cardId) => {
+      const state = load();
+      const s = session(state, sid);
+      const before = (s.pending_moves || []).length;
+      s.pending_moves = (s.pending_moves || []).filter((p) => p.card !== null && p.card !== cardId);
+      if (s.pending_moves.length !== before) save(state);
+    };
+    if (/__update_card$/.test(String(tool)) && /^mcp__/.test(String(tool))) {
+      // The MCP response reaches the hook as {content:[{text:"<json>"}]}: once
+      // stringified, the inner quotes are ESCAPED — match both forms (found live:
+      // the first real update_card did not clear its pending entry).
+      const cid = /\\\\?"cardId\\\\?"\\s*:\\s*\\\\?"([A-Za-z0-9-]+)\\\\?"/.exec(text);
+      const st = /\\\\?"status\\\\?"\\s*:\\s*\\\\?"([^"\\\\]+)\\\\?"/.exec(text);
+      if (cid && st && CLOSING.includes(st[1].toLowerCase())) clearPending(cid[1].toUpperCase());
+      process.exit(0);
+    }
+    if (tool === "Bash") {
+      const cmdText = String(input.command || "");
+      // gh prints "merged pull request #N" only on a TTY: under a tool call the
+      // success line is ABSENT (found live on the first dogfood merge). The
+      // authoritative signal is the PR state itself: one gh pr view per merge.
+      const mergeCmd = /\\bgh\\s+pr\\s+merge(\\s+(\\d+))?/.exec(cmdText);
+      const said = /merged pull request #(\\d+)/i.exec(text);
+      let mergedPr = said ? Number(said[1]) : null;
+      if (mergedPr === null && mergeCmd) {
+        const args = ["pr", "view", ...(mergeCmd[2] ? [mergeCmd[2]] : []), "--json", "number,state"];
+        const r = spawnSync("gh", args, { cwd: ROOT, encoding: "utf8" });
+        try { const v = JSON.parse(r.status === 0 ? r.stdout : "null"); if (v && v.state === "MERGED") mergedPr = Number(v.number); } catch { /* unknown = not confirmed */ }
+      }
+      if (mergedPr !== null) {
+        const state = load();
+        const s = session(state, sid);
+        const ref = CARD.exec(branchOf() || "");
+        (s.pending_moves ||= []).push({ card: ref ? ref[0].toUpperCase() : null, pr: mergedPr, at: Date.now() });
+        save(state);
+      }
+      const moved = /kj\\s+hu\\s+move\\s+([A-Za-z0-9-]+)\\s+([a-z&-]+)/i.exec(String(input.command || ""));
+      if (moved && CLOSING.includes(moved[2].toLowerCase()) && !/error|fail/i.test(text)) clearPending(moved[1].toUpperCase());
+      process.exit(0);
+    }
     const file = input.file_path || input.notebook_path;
     if (!["Write", "Edit", "MultiEdit", "NotebookEdit"].includes(tool) || !file) process.exit(0);
     const state = load();
@@ -194,10 +247,11 @@ const PRETOOL_BODY = `#!/usr/bin/env node
 // before the damage, not in the post-mortem. Exit 2 blocks (stderr says the
 // remediation); read-only tools are never wired here; every honored escape
 // is recorded as an auditable event. Fails OPEN on anything unexpected.
-import { dirname, relative, resolve } from "node:path";
-import { existsSync, realpathSync, statSync } from "node:fs";
+import { dirname, join, relative, resolve } from "node:path";
+import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { spawnSync } from "node:child_process";
-import { CODE, TESTS, ROOT, BASE_BRANCHES, CARD, branchOf, foreignLane, load, violations, recordEscape } from "./sentinel-lib.mjs";
+import { homedir } from "node:os";
+import { CODE, TESTS, ROOT, BASE_BRANCHES, CARD, branchOf, foreignLane, load, violations, recordEscape, pendingMoves, pendingText } from "./sentinel-lib.mjs";
 const EDIT_TOOLS = ["Write", "Edit", "MultiEdit", "NotebookEdit"];
 const PUBLISH = /\\bnpm\\s+publish\\b|\\bfirebase\\s+deploy\\b|\\bgh\\s+release\\s+create\\b/;
 const PUSH = /\\bgit\\s+push\\b/;
@@ -265,6 +319,108 @@ process.stdin.on("end", () => {
       }
       return true;
     };
+    // IDN-B (KJC-TSK-0763, ADR 0005): identity lock — gh and mutating git never
+    // run under an account other than the one THIS CLONE declared (the incident:
+    // a gh comment without switch went out as the client account). Deny BEFORE
+    // the damage with the literal remedy; never auto-switch; undeclared = closed.
+    if (tool === "Bash" && CMD_TEXT.length > 0) {
+      const idFile = join(ROOT, ".karajan", "identity.local.yml");
+      const idLine = (key) => {
+        if (!existsSync(idFile)) return null;
+        const line = readFileSync(idFile, "utf8").split(ESC_NL).find((l) => l.startsWith(key + ":"));
+        const v = line ? line.slice(key.length + 1).trim() : "";
+        return v.length > 0 ? v : null;
+      };
+      const declaredGh = idLine("gh_user");
+      const declaredEmail = idLine("git_email");
+      const ghHostsPath = join(process.env.GH_CONFIG_DIR || join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "gh"), "hosts.yml");
+      const activeGh = () => {
+        if (!existsSync(ghHostsPath)) return null;
+        const lines = readFileSync(ghHostsPath, "utf8").split(ESC_NL);
+        const start = lines.findIndex((l) => l.startsWith("github.com:"));
+        if (start < 0) return null;
+        for (let k = start + 1; k < lines.length; k += 1) {
+          if (lines[k].length > 0 && lines[k][0] !== " " && lines[k][0] !== ESC_TAB) break;
+          const t = lines[k].trim();
+          if (t.startsWith("user:")) { const u = t.slice(5).trim(); return u.length > 0 ? u : null; }
+        }
+        return null;
+      };
+      const words = (seg) => seg.trim().split(" ").filter((w) => w.length > 0 && w !== ESC_TAB);
+      const headOf = (ws) => { let k = 0; while (k < ws.length && ws[k].indexOf("=") > 0 && ws[k].indexOf("=") < ws[k].length) k += 1; return ws.slice(k); };
+      // Wrapper shells hide the payload in a string (review catch): scan inside.
+      const WRAPPERS =["sh", "bash", "zsh", "dash", "eval", "env", "xargs", "sudo", "nohup", "time", "exec"];
+      let switchedTo = null;
+      const problems = [];
+      // $( and backticks are separators too (review catch): their payload is its own segment.
+      const SEPS = [";", "&&", "||", "|", "$(", String.fromCharCode(96), "(", ")"];
+      const bare = (w) => w.replaceAll(String.fromCharCode(39), "").replaceAll(String.fromCharCode(34), "");
+      const scan = (text, depth) => { if (depth > 3) return; for (const seg of SEPS.reduce((acc, s) => acc.flatMap((l) => l.split(s)), text.split(ESC_NL))) checkSeg(headOf(words(seg)), depth, words(seg)); };
+      const checkSeg = (ws, depth, raw) => {
+        if (ws.length === 0) return;
+        if (WRAPPERS.includes(ws[0])) { // wrapper args have arity (sudo -u bob): scan from the first gh/git/wrapper token (review catch)
+          const j = ws.findIndex((w, i) => i > 0 && ["gh", "git", ...WRAPPERS].includes(bare(w)));
+          if (j > 0) scan(ws.slice(j).map(bare).join(" "), depth + 1);
+          return;
+        }
+        if (ws[0] === "gh") {
+          if (ws[1] === "auth") {
+            if (ws[2] === "switch") { const u = ws.indexOf("--user"); if (u > 0 && ws[u + 1]) switchedTo = ws[u + 1]; }
+            return; // session commands ARE the remedy — never blocked
+          }
+          if (!declaredGh) { problems.push("gh without a declared identity for this clone — run: kj identity set"); return; }
+          const eff = switchedTo || activeGh();
+          if (eff !== declaredGh) problems.push("gh as '" + (eff || "no session") + "' but this clone is declared as '" + declaredGh + "' — prefix the command: gh auth switch --user " + declaredGh + " && ...");
+          return;
+        }
+        if (ws[0] === "git") {
+          // Global options (-C, -c, --git-dir, --work-tree...) are NOT re-implemented: they
+          // are forwarded verbatim to git var, so git resolves identity exactly as the real
+          // command would (review catches: -C cumulative, --git-dir, --opt=value forms).
+          const TWO = ["-c", "-C", "--git-dir", "--work-tree", "--namespace", "--super-prefix", "--exec-path", "--config-env"];
+          let k = 1;
+          while (k < ws.length && ws[k].startsWith("-")) k += TWO.includes(ws[k]) && ws[k + 1] ? 2 : 1;
+          const globals = ws.slice(1, k).map(bare);
+          const sub = ws[k];
+          if (sub === "push") { // push authenticates with the gh session, not user.email (review catch)
+            if (!declaredGh) { problems.push("git push without a declared identity for this clone — run: kj identity set"); return; }
+            const eff = switchedTo || activeGh();
+            if (eff !== declaredGh) problems.push("git push with gh session '" + (eff || "no session") + "' but this clone is declared as '" + declaredGh + "' — prefix: gh auth switch --user " + declaredGh + " && ...");
+            return;
+          }
+          // IDN-B2: anything that authors or rewrites commits carries an identity (review catch).
+          if (!["commit", "tag", "merge", "rebase", "cherry-pick", "am", "revert"].includes(sub)) return; // am: the COMMITTER is still this user
+          if (!declaredEmail) { problems.push("git " + sub + " without a declared identity for this clone — run: kj identity set"); return; }
+          // Let GIT resolve author and committer under the command's own environment
+          // (review catch: user.email, -c, GIT_*_EMAIL, EMAIL, GIT_CONFIG_*, includeIf are
+          // its business): git var is the single source of truth.
+          const assigns = raw.slice(0, raw.length - ws.length).filter((w) => w.indexOf("=") > 0);
+          const env = Object.assign({}, process.env);
+          for (const w of assigns) env[w.slice(0, w.indexOf("="))] = bare(w.slice(w.indexOf("=") + 1));
+          const ident = (v) => {
+            const r = spawnSync("git", [...globals, "var", v], { cwd: ROOT, encoding: "utf8", env });
+            const s = r.status === 0 ? String(r.stdout) : "";
+            const a = s.indexOf("<");
+            const b = s.indexOf(">");
+            return a >= 0 && b > a ? s.slice(a + 1, b) : null;
+          };
+          const ai = ws.findIndex((w) => w.startsWith("--author"));
+          const authorRaw = ai < 0 ? null : ws[ai].includes("=") ? ws[ai].slice(ws[ai].indexOf("=") + 1) : ws.slice(ai + 1).join(" ");
+          const authorMail = authorRaw === null ? null : bare(authorRaw.includes("<") ? authorRaw.slice(authorRaw.indexOf("<") + 1, authorRaw.indexOf(">")) : authorRaw.trim());
+          const mails = [authorMail ?? ident("GIT_AUTHOR_IDENT"), ident("GIT_COMMITTER_IDENT")]; // --author overrides the author (review catch); the committer is always git's
+          const offender = mails.find((m) => m !== null && m !== declaredEmail) ?? (mails[0] === null ? "none" : null);
+          if (offender !== null) problems.push("git " + sub + " as '" + offender + "' but this clone is declared as '" + declaredEmail + "' — use: git -c user.email=" + declaredEmail + " " + sub + " ... (or git config user.email " + declaredEmail + ")");
+        }
+      };
+      scan(CMD_TEXT, 0);
+      if (problems.length > 0) {
+        if (escOn("KJ_ALLOW_IDENTITY")) { recordEscape(sid, "KJ_ALLOW_IDENTITY", tool); }
+        else {
+          console.error("kj sentinel: identity lock (ADR 0005) —" + problems.map((p) => ESC_NL + "- " + p).join("") + ESC_NL + "(KJ_ALLOW_IDENTITY=1 = excepcion consciente, queda registrada)");
+          process.exit(2);
+        }
+      }
+    }
     // MONO-0 (KJC-TSK-0737, ADR 0002): cada sesion muta solo SU worktree;
     // otro carril del MISMO repo se deniega ANTES del dano. Lectura libre.
     const laneOf = (p) => {
@@ -475,6 +631,23 @@ process.stdin.on("end", () => {
     }
     if (tool === "Bash") {
       const cmd = String(input.command || "");
+      // KJC-TSK-0765 board-sync: a merge leaves its card PENDING in the tracker
+      // and nothing advances (commit, new PR, another merge; push and the end of
+      // the turn go through violations()) until the card is moved. The board is
+      // true at all times or the method stops — never a rule in the agent's memory.
+      const MERGE = /\\bgh\\s+pr\\s+merge(\\s+(\\d+))?/;
+      const ADVANCE = /\\bgit\\s+commit\\b|\\bgit\\s+push\\b|\\bgh\\s+pr\\s+create\\b/; // push also falls under violations() — explicit here too (review catch)
+      const mergeM = cmd.match(MERGE);
+      const pend = pendingMoves(load().sessions?.[sid]);
+      if (pend.length > 0 && (mergeM || ADVANCE.test(cmd))) {
+        if (escOn("KJ_ALLOW_BOARD")) { recordEscape(sid, "KJ_ALLOW_BOARD", tool); }
+        else {
+          console.error("kj sentinel: board-sync — el metodo no avanza con cards mergeadas sin mover:\\n" + pend.map((p) => "- " + pendingText(p)).join("\\n") + "\\n(KJ_ALLOW_BOARD=1 = excepcion consciente, queda registrada)");
+          process.exit(2);
+        }
+      }
+      // (the pending entry itself is recorded by the PostToolUse hook, only once
+      // gh confirms "merged pull request #N" — a failed merge never blocks)
       if (PUBLISH.test(cmd)) {
         if (escOn("KJ_ALLOW_RELEASE")) { recordEscape(sid, "KJ_ALLOW_RELEASE", tool); process.exit(0); }
         const res = spawnSync("kj", ["release", "check", "--json"], { cwd: ROOT, encoding: "utf8" });
@@ -536,6 +709,11 @@ export function installSentinelHooks({ projectDir = process.cwd(), logger = cons
       { event: "PreToolUse", matcher: "Write|Edit|MultiEdit|NotebookEdit", script: "pretooluse-sentinel.mjs" },
       { event: "PreToolUse", matcher: "Bash", script: "pretooluse-sentinel.mjs" },
       { event: "PostToolUse", matcher: "Write|Edit|MultiEdit|NotebookEdit", script: "posttooluse.mjs" },
+      // KJC-TSK-0765 board-sync: the merge (Bash) and the tracker move (MCP
+      // update_card) are observed AFTER the fact — found live: with only the
+      // edit matchers wired, the board-sync recorder never ran in production.
+      { event: "PostToolUse", matcher: "Bash", script: "posttooluse.mjs" },
+      { event: "PostToolUse", matcher: "mcp__.*__update_card", script: "posttooluse.mjs" },
       { event: "Stop", script: "stop.mjs" },
     ],
   });

package/src/identity/bootstrap.js

@@ -0,0 +1,48 @@
+/**
+ * Identity lock — bootstrap (IDN-A, KJC-TSK-0762). Runs at the end of
+ * `kj harden` (and therefore `kj env install`): if this clone has no declared
+ * identity, capture it — but ONLY with a human confirming on a TTY. Headless
+ * runs never bind blindly (the first real `set --yes` bound a clone to an
+ * account another session had switched to); they report the pending step
+ * with the exact command instead. Fail-loud, never a guess.
+ */
+
+import { readIdentity, writeIdentity } from "./store.js";
+import { activeGhUser, effectiveGitEmail } from "./detect.js";
+import { createWizard, isTTY } from "../utils/wizard.js";
+
+/**
+ * @param {{projectDir: string, logger?: object, deps?: object}} args
+ * @returns {Promise<{declared: boolean, identity: object|null, pending: string|null}>}
+ */
+export async function ensureIdentity({ projectDir, logger = null, deps = {} }) {
+  const existing = readIdentity(projectDir);
+  if (existing) return { declared: true, identity: existing, pending: null };
+
+  const gh = activeGhUser(deps.hostsPath ? { hostsPath: deps.hostsPath } : {});
+  const email = effectiveGitEmail(projectDir, deps.gitFn ? { gitFn: deps.gitFn } : {});
+  const hint = `kj identity set --gh ${gh ?? "<user>"} --email ${email ?? "<email>"}`;
+  const tty = (deps.isTTY || isTTY)();
+
+  if (!tty || !gh || !email) {
+    const why = !gh || !email ? "no active gh session or git email" : "non-interactive run";
+    const pending = `identity not declared for this clone (${why}) — run: ${hint}`;
+    logger?.warn?.(`kj identity: ${pending}`);
+    return { declared: false, identity: null, pending };
+  }
+
+  const wizard = (deps.makeWizard || createWizard)();
+  try {
+    const ok = await wizard.confirm(`Bind this clone to gh ${gh} / git ${email}? (other sessions may switch gh accounts — verify)`, true);
+    if (!ok) {
+      const pending = `identity not declared (declined) — run: ${hint}`;
+      logger?.warn?.(`kj identity: ${pending}`);
+      return { declared: false, identity: null, pending };
+    }
+  } finally {
+    wizard.close();
+  }
+  const identity = writeIdentity(projectDir, { gh_user: gh, git_email: email });
+  logger?.info?.(`kj identity: declared gh ${gh} / git ${email} → .karajan/identity.local.yml (ignored by git)`);
+  return { declared: true, identity, pending: null };
+}

package/src/identity/compare.js

@@ -0,0 +1,38 @@
+/**
+ * Identity lock — compare (IDN-A, KJC-TSK-0762). Pure: declared vs effective
+ * → {ok, mismatches}. Every mismatch carries the LITERAL remedy, because the
+ * gate (IDN-B) and the hooks (IDN-C) print it instead of auto-switching —
+ * changing the user's keyring is the user's act, never the agent's.
+ */
+
+/**
+ * @param {{gh_user: string, git_email: string}|null} declared
+ * @param {{gh_user: string|null, git_email: string|null}} effective
+ * @returns {{ok: boolean, mismatches: Array<{field: string, declared: string|null, effective: string|null, remedy: string}>}}
+ */
+export function compareIdentity(declared, effective) {
+  if (!declared) {
+    return {
+      ok: false,
+      mismatches: [{ field: "identity", declared: null, effective: null, remedy: "kj identity set — this clone has no declared identity yet" }],
+    };
+  }
+  const mismatches = [];
+  if (effective.gh_user !== declared.gh_user) {
+    mismatches.push({
+      field: "gh_user",
+      declared: declared.gh_user,
+      effective: effective.gh_user ?? null,
+      remedy: effective.gh_user ? `gh auth switch --user ${declared.gh_user}` : `gh auth login (as ${declared.gh_user}) or gh auth switch --user ${declared.gh_user}`,
+    });
+  }
+  if (effective.git_email !== declared.git_email) {
+    mismatches.push({
+      field: "git_email",
+      declared: declared.git_email,
+      effective: effective.git_email ?? null,
+      remedy: `git config user.email ${declared.git_email} (or -c user.email=${declared.git_email} on the command)`,
+    });
+  }
+  return { ok: mismatches.length === 0, mismatches };
+}

package/src/identity/detect.js

@@ -0,0 +1,51 @@
+/**
+ * Identity lock — detect (IDN-A, KJC-TSK-0762). What is EFFECTIVE right now,
+ * with no network and no spawned `gh`: the active gh account is read from
+ * gh's own hosts.yml (the file `gh auth switch` mutates), the git email from
+ * `git config user.email`. Both return null when unknown — never a guess.
+ */
+
+import { existsSync, readFileSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+import { join } from "node:path";
+import { homedir } from "node:os";
+import yaml from "js-yaml";
+
+export function defaultHostsPath() {
+  const base = process.env.GH_CONFIG_DIR || join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "gh");
+  return join(base, "hosts.yml");
+}
+
+/**
+ * @param {{hostsPath?: string, host?: string}} [opts]
+ * @returns {string|null} active gh login for the host, null without a session
+ */
+export function activeGhUser({ hostsPath = defaultHostsPath(), host = "github.com" } = {}) {
+  if (!existsSync(hostsPath)) return null;
+  try {
+    const parsed = yaml.load(readFileSync(hostsPath, "utf8"));
+    const user = parsed?.[host]?.user;
+    return typeof user === "string" && user.length > 0 ? user : null;
+  } catch {
+    return null;
+  }
+}
+
+const defaultGitFn = (projectDir) =>
+  execFileSync("git", ["config", "--get", "user.email"], { cwd: projectDir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+
+/**
+ * @param {string} projectDir
+ * @param {{gitFn?: (projectDir: string) => string}} [opts]
+ * @returns {string|null}
+ */
+export function effectiveGitEmail(projectDir, { gitFn = defaultGitFn } = {}) {
+  try {
+    // --get yields the single effective value; keep the last line anyway so a
+    // multi-line answer from an odd config can never leak a newline into it.
+    const out = String(gitFn(projectDir) || "").trim().split("\n").at(-1).trim();
+    return out.length > 0 ? out : null;
+  } catch {
+    return null;
+  }
+}

package/src/identity/store.js

@@ -0,0 +1,66 @@
+/**
+ * Identity lock — store (IDN-A, KJC-TSK-0762, epic KJC-PCS-0079).
+ *
+ * Each CLONE declares the identity it is worked with: the gh account and the
+ * git email. It is per developer, not per project, so it lives in
+ * `.karajan/identity.local.yml`, never tracked (this module keeps it in the
+ * .gitignore). Born from the 2026-08-20 incident: one `gh` call without an
+ * explicit account switch posted as a client account on a public repo.
+ */
+
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import yaml from "js-yaml";
+
+export const IDENTITY_FILE = ".karajan/identity.local.yml";
+
+/** @param {string} projectDir */
+export function identityPath(projectDir) {
+  return join(projectDir, ".karajan", "identity.local.yml");
+}
+
+/**
+ * @param {string} projectDir
+ * @returns {{gh_user: string, git_email: string, declared_at: string}|null}
+ */
+export function readIdentity(projectDir) {
+  const p = identityPath(projectDir);
+  if (!existsSync(p)) return null;
+  let parsed;
+  try {
+    parsed = yaml.load(readFileSync(p, "utf8"));
+  } catch {
+    return null; // corrupt or half-written file = no identity (review catch)
+  }
+  if (!parsed || typeof parsed !== "object" || !parsed.gh_user || !parsed.git_email) return null;
+  return { gh_user: String(parsed.gh_user), git_email: String(parsed.git_email), declared_at: String(parsed.declared_at || "") };
+}
+
+/**
+ * Write the declaration and make sure it never gets tracked. Fails loud on
+ * an incomplete identity — a half-declared lock is no lock.
+ * @param {string} projectDir
+ * @param {{gh_user: string, git_email: string}} identity
+ */
+export function writeIdentity(projectDir, identity) {
+  for (const field of ["gh_user", "git_email"]) {
+    if (!identity?.[field] || typeof identity[field] !== "string") {
+      throw new Error(`identity: "${field}" is required (got ${JSON.stringify(identity?.[field])})`);
+    }
+  }
+  // Ignore FIRST, write SECOND (review catch): if the ignore step fails, no
+  // unignored identity file is ever left on disk for git to pick up.
+  ensureIgnored(projectDir);
+  mkdirSync(join(projectDir, ".karajan"), { recursive: true });
+  const record = { gh_user: identity.gh_user, git_email: identity.git_email, declared_at: new Date().toISOString() };
+  writeFileSync(identityPath(projectDir), yaml.dump(record, { lineWidth: 120 }), "utf8");
+  return record;
+}
+
+function ensureIgnored(projectDir) {
+  const ignorePath = join(projectDir, ".gitignore");
+  const current = existsSync(ignorePath) ? readFileSync(ignorePath, "utf8") : "";
+  if (current.split("\n").some((line) => line.trim() === IDENTITY_FILE)) return;
+  const sep = current.length === 0 || current.endsWith("\n") ? "" : "\n";
+  writeFileSync(ignorePath, `${current}${sep}${IDENTITY_FILE}\n`, "utf8");
+}